← worklog

2024-06-01

Internal Terraform module for opinionated EKS clusters

TerraformAWS EKSKarpenterGitLab CI

Problem

Each team was hand-rolling EKS clusters from the upstream terraform-aws-modules/eks module with slight variations. Security group rules, add-on versions, and IRSA setup drifted across clusters.

What the module wraps

  • VPC with private subnets tagged for EKS, NAT gateways per AZ
  • EKS cluster with private endpoint + allowlisted CIDRs for bastion/CI access
  • Managed add-ons pinned to tested versions (CoreDNS, kube-proxy, VPC CNI, EBS CSI)
  • Karpenter as default autoscaler (NodePool and EC2NodeClass templates included)
  • IRSA roles for common controllers (ESO, Karpenter, EBS CSI, Load Balancer Controller)

Interface

module "eks" {
  source  = "gitlab.example.com/platform/terraform-eks/aws"
  version = "~> 2.0"

  cluster_name    = "my-cluster"
  cluster_version = "1.30"
  vpc_id          = module.vpc.vpc_id
  subnet_ids      = module.vpc.private_subnets
  tags            = local.tags
}

Teams can override any default through variable pass-through, but 95% of clusters use only the required inputs.

Versioning

Module versions align with EKS minor versions. A cluster on 1.30 uses module 2.x. Upgrade = bump version, run plan, review add-on changes.